Authentication Bypass in WP Events Manager Plugin by WordPress
CVE-2026-14205
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 7 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14205?
The WP Events Manager plugin prior to version 2.2.5 is susceptible to an authentication bypass vulnerability. This flaw allows authenticated users to manipulate the quantity of event tickets during the registration process. As a result, attackers can create legitimate bookings for paid events without actual payment, leading to potential revenue loss for event organizers and unauthorized event attendance.
Affected Version(s)
WP Events Manager 0 < 2.2.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.